diff --git a/.github/workflows/check-pr-format.yaml b/.github/workflows/check-pr-format.yaml
index 2ab13e6..a0679c8 100644
--- a/.github/workflows/check-pr-format.yaml
+++ b/.github/workflows/check-pr-format.yaml
@@ -13,7 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     container: qctrl/ci-images:python-3.11-ci
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Check PR format
         shell: bash
         run: /scripts/check-pr-format.sh
diff --git a/.github/workflows/on-pull-request.yaml b/.github/workflows/on-pull-request.yaml
index 1791212..55e1392 100644
--- a/.github/workflows/on-pull-request.yaml
+++ b/.github/workflows/on-pull-request.yaml
@@ -16,7 +16,9 @@ jobs:
     runs-on: ubuntu-latest
     container: qctrl/ci-images:python-3.11-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Download CI tool
         shell: bash
         run: |
@@ -32,7 +34,9 @@ jobs:
     runs-on: ubuntu-latest
     container: qctrl/ci-images:python-3.11-ci
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Download CI tool
       shell: bash
       run: |
@@ -54,7 +58,9 @@ jobs:
       matrix:
         python: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Download CI tool
       shell: bash
       run: |
@@ -72,7 +78,9 @@ jobs:
     if: github.event.pull_request.head.repo.fork == true
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Build Sphinx Image
       run: |
         docker build -f ./docs/Dockerfile
diff --git a/.github/workflows/on-push.yaml b/.github/workflows/on-push.yaml
index 0818ef0..d23316c 100644
--- a/.github/workflows/on-push.yaml
+++ b/.github/workflows/on-push.yaml
@@ -12,7 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     container: qctrl/ci-images:python-3.11-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Download CI tool
         shell: bash
         run: |
@@ -36,7 +38,9 @@ jobs:
     runs-on: ubuntu-latest
     container: qctrl/ci-images:python-3.11-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Download CI tool
         shell: bash
         run: |
@@ -59,7 +63,9 @@ jobs:
       matrix:
         python: ["3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Download CI tool
         shell: bash
         run: |
@@ -79,7 +85,9 @@ jobs:
     runs-on: ubuntu-latest
     container: qctrl/ci-images:python-3.11-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Download CI tool
         shell: bash
         run: |
diff --git a/.github/workflows/on-release.yaml b/.github/workflows/on-release.yaml
index fb03d0b..55b7e4f 100644
--- a/.github/workflows/on-release.yaml
+++ b/.github/workflows/on-release.yaml
@@ -9,8 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     container: qctrl/ci-images:python-3.11-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Download CI tool
         shell: bash